Privacy Policy

Effective 27 September 2026 · Applies to the Twengo ScanGo app, book.twengo.io and twengo.io

In short: we collect what we need to run a fare payment service on M-PESA: your phone number, your name, the payments you collect or make, and the bookings you place. We do not sell your data. We do not use it for advertising. You can delete your account inside the app at any time.

1. Who we are

The ScanGo app and the Twengo booking site are operated in Kenya by TWENGO LTD, a company registered in Kenya. The app is published in the Apple App Store and Google Play by A&K Worldwide Enterprises FZCO, Sheikh Rashid Tower, Dubai World Trade Centre, Dubai, United Arab Emirates, which builds and maintains the software.

For the purposes of the Kenya Data Protection Act, 2019, TWENGO LTD is the data controller for personal data processed in connection with the service. Contact: info@twengo.io.

2. What we collect

If you are a conductor or business using the ScanGo app

Account details: your name, your Safaricom phone number, a PIN (stored only as a one-way hash, never in plain text), and a conductor number we assign to you.
Verification: when phone verification is active, a one-time code is sent to your number by SMS. The code is stored hashed and expires after a few minutes.
Business details you enter: business name, vehicle, route or location, if you choose to add them. These appear on receipts.
Payment records: for every fare collected through the app, the amount, time, M-PESA receipt number, the paying customer's phone number as returned by Safaricom, and which conductor requested the payment.
Wallet and payout records: your balance, each credit and debit, payout amounts, fees, and the M-PESA transaction reference of each payout.
Payment search: when you look up a payment by phone number, we log which conductor searched for what and when. This exists to prevent misuse of customer numbers.
Referrals: if you enter another conductor's referral code, we record who referred whom and when a reward was earned.
Device and session: a session token so you stay signed in. We do not collect precise location, contacts, or device identifiers.
Camera: the app uses the camera to scan QR codes. Images are processed on the device and are not uploaded.

If you pay a fare or book a seat

Booking details: the trip, seat, date, your phone number, your name, and, on long distance services where Kenya Railways requires it, your national ID or passport number.
Payment: the amount, M-PESA receipt number and your phone number as returned by Safaricom. We never see or store your M-PESA PIN.
Booking code: a short code that identifies your ticket. It is shown on your pass and can be used to find your booking again.

If you visit our websites

Our websites are static pages hosted on Vercel. Vercel records standard server logs (IP address, browser type, pages requested) for security and reliability. We do not run advertising trackers or analytics cookies.

3. Why we process it

Purpose	Basis
Sending M-PESA payment prompts and confirming payments	Performance of the service you asked for
Recording fares, balances and payouts	Performance of the service; legal record keeping
Letting a conductor find a payment when a passenger's phone is off	Performance of the service; legitimate interest in preventing fare disputes
Issuing and checking tickets, including ID on long distance trains	Performance of the service; legal requirement of the rail operator
Phone verification and fraud prevention	Legitimate interest in keeping accounts and payouts secure
Referral rewards	Performance of the referral programme you joined
Responding to support requests	Legitimate interest; your consent when you contact us

4. Who we share it with

Safaricom PLC (M-PESA and Daraja API): to send payment prompts, receive payment confirmations and make payouts. Safaricom processes your phone number and transaction data under its own privacy policy.
Supabase: hosts our database and server functions. Data is encrypted in transit and at rest.
Vercel: hosts our websites.
Africa's Talking: delivers verification and receipt SMS to your number.
Kenya Railways Corporation: for train bookings, the passenger name, seat and, where required, ID number are shared so the ticket can be honoured on board.
Authorities: where Kenyan law requires it, for example a lawful request from the Central Bank of Kenya, the Office of the Data Protection Commissioner, or law enforcement.

We do not sell personal data and we do not share it with advertisers.

5. Where it is stored

Our servers are provided by Supabase and may be located outside Kenya. Where personal data leaves Kenya, we rely on the provider's contractual safeguards and encryption. Payment processing itself happens within Safaricom's systems in Kenya.

6. How long we keep it

Payment and payout records: retained for as long as Kenyan tax and financial record keeping rules require, currently up to seven years, even after you delete your account.
Account details: until you delete your account, then removed within 30 days except where a record must be kept under the rule above.
Bookings: kept for the duration of the trip plus the retention period for payment records.
Verification codes: minutes.
Payment search logs: 12 months.

7. Your rights

Under the Kenya Data Protection Act, 2019 you have the right to be informed, to access your data, to have inaccurate data corrected, to request deletion, to object to certain processing, and to lodge a complaint with the Office of the Data Protection Commissioner (odpc.go.ke).

To exercise any of these rights, write to info@twengo.io from the phone number or email on your account. We answer within 30 days.

8. Deleting your account

In the ScanGo app, open the menu and choose Delete account. You will be asked for your PIN. Your account, session and profile are removed immediately. Payment records are kept only as described in section 6, in anonymised form where possible. You can also ask us by email; see Delete account for the full procedure.

9. Security

PINs are stored as salted hashes. API keys and payment credentials live only on our servers, never inside the app. Every request from the app is tied to a session token. Payouts can only go to the phone number registered on your account. We log access to customer phone numbers.

10. Children

The service is for people aged 18 and over. We do not knowingly collect data from anyone younger. If you believe a minor has registered, contact us and we will remove the account.

11. Changes

When we change this policy we update the date at the top. For material changes we notify active users inside the app.

12. Contact

TWENGO LTD · Nairobi, Kenya · info@twengo.io
A&K Worldwide Enterprises FZCO · Dubai World Trade Centre, Dubai, UAE